MT.1115: AI agents should not have risky HTTP configurations.
| ID | MT.1115 |
| Severity | Medium |
| Suite | Mito |
| Product | Copilot Studio |
| Feature | Agents |
| Security area | AI and agents |
| Resource type | Agent |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:SC-7 Boundary Protection |
| MITRE ATT&CK | T1571, T1048, T1071.001 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”AI agents should not use risky HTTP configurations.
Agents with HTTP request nodes in topics connecting to non-standard ports or using plain HTTP (instead of HTTPS) may be misconfigured or could indicate data exfiltration or command-and-control communication channels.
How to fix
Section titled “How to fix”Review the HTTP request nodes in each flagged agent’s topics. Ensure all HTTP requests use HTTPS on standard port 443. Replace direct HTTP calls with Power Platform connectors where possible, as connectors provide built-in governance and DLP policy enforcement.
Learn more: Configure data policies for agents
Mito check. Author: lnfernux. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.